Path Traversal Vulnerability in Servor

Servor versions 1.0.0 through 4.0.2 contain a path traversal vulnerability that exposes the host file system to unauthenticated remote attackers. The vulnerability resides within the serveStaticFile and serveDirectoryListing functions, where the application incorrectly handles URL-encoded dot segments. Specifically, the application uses decodeURI() on the input path before processing it with path.join(), effectively negating intended directory protections. An attacker can supply a specially crafted request containing %2e%2e/ sequences to escape the designated root directory. This allows for the exfiltration of sensitive configuration files, source code, or internal system data, as well as the ability to traverse and enumerate the directory structure of the underlying server.

Impact

Successful exploitation allows unauthenticated remote attackers to bypass access controls to read arbitrary files and enumerate directory contents on the server. This can lead to significant information disclosure, exposing sensitive environment variables, system credentials, or proprietary application logic, which may facilitate further compromise of the host system.

Recommendation

• Upgrade the Servor package to version 4.0.3 or later to receive the patch that properly sanitizes input paths against traversal sequences.
• Configure the web server environment to restrict access to sensitive root directories and apply least-privilege principles to the user account running the Servor application process.
• Implement strict ingress filtering and inspection on the perimeter firewall or web application firewall to identify and block requests containing URL-encoded path traversal sequences such as %2e%2e/.